0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2024, 18:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
Size

73KB
MD5

c9c2358907648d44fee6ed45028ea77b
SHA1

81b39afed89f7227657dfa9245e08e38dd273194
SHA256

0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32
SHA512

7840fe1ea4c40e0662cb49238cacc5d0bc6751881a606bec9d7afd2a87fd0cd1ebb2838dc2983850d4627af036d63ecfc45d390895b97cc8685d107212f0f943
SSDEEP

768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcC+3mC+3meDAfABJ6fABJwEXBwzEO:/7ZQpApze+eJfFpsJOfFpsJ5Ddu7ey

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5202) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Design.resources.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\ReachFramework.resources.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngom.md.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ppd.xrm-ms.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentlogon.xml.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.resources.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected]	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Java\jre-1.8\bin\jpeg.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.ResourceManager.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClientSideProviders.resources.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.resources.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ppd.xrm-ms.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsFormsIntegration.resources.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.Messages.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-phn.xrm-ms.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ul-oob.xrm-ms.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excel.exe.manifest.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\EUROTOOL.XLAM.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\nslist.hxl.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Extensions.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ul-oob.xrm-ms.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ul-oob.xrm-ms.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\hive.xsl.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Primitives.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.TypeExtensions.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.resources.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunmscapi.jar.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ppd.xrm-ms.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ppd.xrm-ms.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\OMICAUTINTL.DLL.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ppd.xrm-ms.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.runtimeconfig.json.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.VisualC.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore_amd64_amd64_8.0.224.6711.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsBase.resources.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.resources.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Xaml.resources.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-pl.xrm-ms.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ppd.xrm-ms.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.Edm.NetFX35.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ppd.xrm-ms.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-pl.xrm-ms.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\javaws.policy.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ul-oob.xrm-ms.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-pl.xrm-ms.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.EXCEL.16.1033.hxn.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\netstandard.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\msquic.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Calendars.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\JAWTAccessBridge-64.dll.tmp	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe

C:\Users\Admin\AppData\Local\Temp\0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe
"C:\Users\Admin\AppData\Local\Temp\0c6c49a9cbf0244595eb99ea8cb86bd0498439adf1ff9f742d0b6b133ef56a32.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
73KB

MD5
4783594cf64b4e81d4ffebfd9e1e8e08

SHA1
a89751bd53d2a6d25125c0f2495bb335fade27a7

SHA256
1e8e9efca53dc251d445204719708bf326bfb85c583223cab846eb4f0c8a6f25

SHA512
9b3862c376565e95adf9e2d5971b4b39814d6d7f77b4951f708be8aa85a88c3154d562ae169303021a1af63638c794612c8e1471e57c49c2d859d2d5f59736bd

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
172KB

MD5
28d2816f13cf60961ec12e2da2c6f461

SHA1
90ace6cd11b7e9feb0203227646f330f55a0b0f0

SHA256
4455baed4363e4c5940374e79883d36c9e3db5dc4ec6425ec1633f0bd8fe4c9b

SHA512
318ddd0961817301cb470a981b7f89feed72288e90e0138a730efbc2307f242c443a1af0a7563e56eebc2876ae06cded30bc22347243ad5e36e20145c5198134

Download Submit
memory/1180-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1180-1972-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download